{"id":"CURL-CVE-2026-82208","summary":"wolfSSL CA-cache hit overrides callback","details":"With the wolfSSL backend, when CA caching is enabled and an\n`CURLOPT_SSL_CTX_FUNCTION` callback replaces the trust store, libcurl can\nsilently reinstall the cached store after the callback returns. A certificate\ntrusted by the cached store but rejected by the callback-selected store is\nthen incorrectly accepted.","aliases":["CVE-2026-82208"],"modified":"2026-09-03T02:01:57.205107Z","published":"2026-09-02T08:00:00Z","database_specific":{"package":"curl","severity":"Low","www":"https://curl.se/docs/CVE-2026-82208.html","CWE":{"desc":"Improper Certificate Validation","id":"CWE-295"},"URL":"https://curl.se/docs/CVE-2026-82208.json","affects":"lib","issue":"https://hackerone.com/reports/3973090","last_affected":"8.21.0"},"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"8.9.1"},{"fixed":"8.22.0"}]},{"type":"GIT","repo":"https://github.com/curl/curl.git","events":[{"introduced":"0f2876b2c33f6784a27b6f7345bd8cd95b46352a"},{"fixed":"ed0338befd1d865a8ea1fbaa90013a096dedd07a"}]}],"versions":["8.21.0","8.20.0","8.19.0","8.18.0","8.17.0","8.16.0","8.15.0","8.14.1","8.14.0","8.13.0","8.12.1","8.12.0","8.11.1","8.11.0","8.10.1","8.10.0","8.9.1","rc-8_22_0-3","rc-8_22_0-2","rc-8_22_0-1","curl-8_21_0","rc-8_21_0-3","rc-8_21_0-2","rc-8_21_0-1","curl-8_20_0","rc-8_20_0-3","rc-8_20_0-2","rc-8_20_0-1","curl-8_19_0","rc-8_19_0-3","rc-8_19_0-2","rc-8_19_0-1","curl-8_18_0","rc-8_18_0-3","rc-8_18_0-2","rc-8_18_0-1","curl-8_17_0","curl-8_16_0","curl-8_15_0","curl-8_14_1","curl-8_14_0","curl-8_13_0","curl-8_12_1","curl-8_12_0","curl-8_11_1","curl-8_11_0","curl-8_10_1","curl-8_10_0","curl-8_9_1"],"database_specific":{"vanir_signatures":[{"target":{"file":"lib/vtls/wolfssl.c"},"deprecated":false,"digest":{"line_hashes":["3923404689551009163607441279828111175","297624718997870639840150836257476086448","56205908250059361441879990564662064602","85439685350400643831478693185264849405","206455418915853995366232742870540736875","308268091786777598060810704004673016972","317513464329706427293671634178034016553","69518472294264634418027510581645809159","72674729481011985343164199229800799409","194300608716949252276030240923330874213","81827856355291595232907156722595705799"],"threshold":0.9},"id":"CURL-CVE-2026-82208-004be86c","signature_type":"Line","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a"},{"digest":{"function_hash":"39676463464626033682420662062357537373","length":1763},"id":"CURL-CVE-2026-82208-790f655b","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a","target":{"file":"lib/vtls/wolfssl.c","function":"wssl_init_ech"},"deprecated":false},{"target":{"file":"lib/vtls/wolfssl.c","function":"wssl_populate_x509_store"},"deprecated":false,"digest":{"function_hash":"1807422166572413733492374297762200315","length":2147},"id":"CURL-CVE-2026-82208-9159197f","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a"},{"id":"CURL-CVE-2026-82208-9a967e5c","signature_type":"Function","signature_version":"v1","source":"https://github.com/curl/curl.git/commit/ed0338befd1d865a8ea1fbaa90013a096dedd07a","target":{"file":"lib/vtls/wolfssl.c","function":"Curl_wssl_setup_x509_store"},"deprecated":false,"digest":{"function_hash":"128549031654971917451338542360004250539","length":973}}],"source":"https://curl.se/docs/CURL-CVE-2026-82208.json","vanir_signatures_modified":"2026-09-03T02:01:57Z"}}],"schema_version":"1.9.0","credits":[{"name":"Stanislav Fort (Aisle Research)","type":"FINDER"},{"name":"Stefan Eissing","type":"REMEDIATION_DEVELOPER"}]}